| Message ID | 1457565024-27300-4-git-send-email-jarno@ovn.org |
|---|---|
| State | Changes Requested |
| Delegated to: | Pablo Neira |
| Headers | show |
On 9 March 2016 at 15:10, Jarno Rajahalme <jarno@ovn.org> wrote: > Only a successful nf_conntrack_in() call can effect a connection state > change, so if suffices to update the key only after the > nf_conntrack_in() returns. "it" suffices to update... > This change is needed for the later NAT patches. > > Signed-off-by: Jarno Rajahalme <jarno@ovn.org> Acked-by: Joe Stringer <joe@ovn.org> -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c index 8cd0110..da804d3 100644 --- a/net/openvswitch/conntrack.c +++ b/net/openvswitch/conntrack.c @@ -382,7 +382,8 @@ static bool skb_nfct_cached(const struct net *net, const struct sk_buff *skb, } /* Pass 'skb' through conntrack in 'net', using zone configured in 'info', if - * not done already. Update key with new CT state. + * not done already. Update key with new CT state after passing the packet + * through conntrack. * Note that if the packet is deemed invalid by conntrack, skb->nfct will be * set to NULL and 0 will be returned. */ @@ -411,14 +412,14 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key, skb) != NF_ACCEPT) return -ENOENT; + ovs_ct_update_key(skb, info, key, true); + if (ovs_ct_helper(skb, info->family) != NF_ACCEPT) { WARN_ONCE(1, "helper rejected packet"); return -EINVAL; } } - ovs_ct_update_key(skb, info, key, true); - return 0; }
Only a successful nf_conntrack_in() call can effect a connection state change, so if suffices to update the key only after the nf_conntrack_in() returns. This change is needed for the later NAT patches. Signed-off-by: Jarno Rajahalme <jarno@ovn.org> --- net/openvswitch/conntrack.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)